Brokey.dll

info
MZ
PE
resources
imports
exports
foremost
hexdump
disasm
log
discuss
donate

filename	Brokey.dll
size	6144 (0x1800)
md5	189292dc7a932d36b319658148d5f731

type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xf0

Rich Header

lib id	version	times used
19	8034	2
11	8047	1
14	7299	2
10	8047	4
4	8047	3
1	0	32
4	9782	2
11	9782	8
6	1735	1
4	8447	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	5
TimeDateStamp	0x4128f5cc
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x210e
Magic	0x10b
LinkerVersion	6.0
SizeOfCode	0x600
SizeOfInitializedData	0x2000
SizeOfUninitializedData	0
AddressOfEntryPoint	0x138f
BaseOfCode	0x1000
BaseOfData	0x2000
ImageBase	0x10300000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	4.0
ImageVersion	0.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0x7000
SizeOfHeaders	0x400
CheckSum	0
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MS Visual C++ 6.0 DLL

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x546	0x600	R-X CODE
.rdata	0x2000	0x4c5	0x600	R-- IDATA
.data	0x3000	0x12a4	0x200	RW- IDATA
.rsrc	0x5000	0x220	0x400	R-- IDATA
.reloc	0x6000	0x118	0x200	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0x2350	0x175
IMPORT	0x2190	0x50
RESOURCE	0x5000	0x220
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0x6000	0xec
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0x2000	0x88
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size	cp
DIALOG	#17001	442	0

module_name	hint	ord	function_name
MSVCRT.dll	390		_onexit
MSVCRT.dll	85		__dllonexit
MSVCRT.dll	14		public: virtual __thiscall type_info::~type_info(void) ??1type_info@@UAE@XZ
MSVCRT.dll	16		void __cdecl operator delete(void *) ??3@YAXPAX@Z
MSVCRT.dll	157		_adjust_fdiv
MSVCRT.dll	657		malloc
MSVCRT.dll	271		_initterm
MSVCRT.dll	606		free
MSVCRT.dll	15		void * __cdecl operator new(unsigned int) ??2@YAPAXI@Z
MSVCRT.dll	73		__CxxFrameHandler
MSVCRT.dll	695		strchr
MSVCRT.dll	614		fwrite
KERNEL32.dll	460		LocalFree
KERNEL32.dll	456		LocalAlloc
MFC42.DLL		1575
MFC42.DLL		1168
MFC42.DLL		1577
MFC42.DLL		1182
MFC42.DLL		342
MFC42.DLL		1176
MFC42.DLL		1197
MFC42.DLL		1570
MFC42.DLL		1253
MFC42.DLL		1255
MFC42.DLL		6467
MFC42.DLL		1116
MFC42.DLL		1243
MFC42.DLL		269
MFC42.DLL		826
MFC42.DLL		600
MFC42.DLL		1578

ord	entry_va	function_name
1	0x1076	?CheckAuthorization@@YAHXZ
2	0x101c	?ConvertEncoding@@YAXPADHH@Z
3	0x109d	?GimmeRegDate@@YAPADXZ
4	0x10a3	?GimmeUserID@@YAPADXZ
5	0x1097	?GimmeUserName@@YAPADXZ
6	0x10a9	?KeyCalcFileSize@@YAHH@Z
7	0x1018	?KeyPrepareDataToSave@@YAHPAEPAUStockInfo@@HH@Z
8	0x1000	?KeyWrite@@YAHPAU_iobuf@@PAXPAULibrary@@H@Z

module_name	Brokey.dll
flags	0
timestamp	2004-08-22 19:36:44
version	0.0
ordinal_base	1
nFunctions	8
nNames	8
Names(8)	0x2398
Functions(8)	0x2378
NameOrdinals(8)	0x23b8

show previews

offset	size	type	comment
0	6144	DLL	08/22/2004 19:36:44	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK